[r3dbars]

Record the exact files, SHA-256 hashes and available upstream revisions of bundled models, and retain that manifest in the downloadable Release Candidate artifact. This makes the model bytes inspectable alongside the app without changing the signed bundle or model selection.

The PR now includes current main through a normal merge, preserves the original implementation commit, and fixes the reviewed artifact handoff gap:

• Require a nonempty manifest before uploading the unsigned app.
• Upload the manifest with that app, recover it in the verification job, and include it beside the final DMG and dSYM.
• Run the seven manifest fixtures in the Linux CI lane.
• Add parsed-workflow contract checks for the complete handoff and early failure when the manifest is missing.

Review and validation

Two independent Opus reviews are GREEN: the original manifest implementation and the updated full patch. The follow-up review verified the frozen patch hash 45781b71b7e74fa32816d14f26195e6c0c2221084916f118e74bbd2e096ad651. The final small follow-up clarifies that the transfer does not rehash the signed DMG and adds the early-failure assertion.

• Quick suite: 114 passed, 0 failed, 0 skipped before that final wording/assertion follow-up.
• Actual CIWorkflowContractTests.swift, compiled in a standalone Foundation harness: 86 assertions passed on the final patch. The three handoff assertions failed before the workflow repair; removing the early guard fails its new assertion.
• Model-manifest Python tests: 7 passed on the final patch.
• Shell syntax and diff whitespace checks passed.
• The mapped local check was stopped at dependency fetching after over 13 minutes without progress (exit 143); its result is INCOMPLETE, with no product test failure established. Only its verified process tree was terminated. Fresh PR CI on replacement head 9634b08 is green after one controlled app-build retry; Repo Hygiene, checks, spm-tests, app-build and build-and-test passed. The original performance failure remains recorded below. The prior-head hygiene failure was in the Python symlink-loop fixture, already fixed by the main merge; it is not treated as a current-head pass.

Scope and remaining proof

This is release preparation, not a release. No models were downloaded or changed, no live artifact was published, and no signing secret was used. A real Release Candidate run must still prove the cross-job transfer; the manifest is not rechecked against the opened signed DMG yet.

Hashes establish which bundled bytes were used, not legal approval or an upstream identity when one is absent. Missing upstream revisions remain explicit null values. The earlier low-priority upstream-pin, transformed-layout and symlink-coverage observations remain follow-ups, and licensing decisions are not claimed resolved.

Sequence with #2679 before cutting the 1.1.77 prep branch; both touch the Release Candidate workflow. Validate the resulting combined source and final candidate before promotion.

Current-head CI failure: the app compiled and signed successfully, but the Home recent-captures performance gate failed at 10,000 synthetic captures (average load 844.5 ms against a 750 ms ceiling). Failing job. Lab typecheck was skipped after this failure. Independent triage verified all 26 compiled benchmark inputs, the Swift CI workflow and the 750 ms budget are byte-identical to main and passing sibling branches. Those sibling runs averaged 288.2 and 311.0 ms; the preceding 29 recorded runs ranged 229.2–540.1 ms. Runner variability is the leading explanation, not a proven cause. Core/package tests and the checks job completed successfully. The build-and-test aggregate failed because of the same app-build performance failure; no additional failing suite was found. The one controlled rerun of the failed app-build job on the unchanged commit passed: 10,000-capture average 332.8 ms (raw 429.6, 308.4, 330.1, 291.5, 304.5), cancellation 1.1 ms, and lab typecheck passed. Retry job. This supports runner variability; it is explicitly a pass on retry, not a first-pass result. No further retries. The original failure is preserved and the budget is unchanged.